Data Carving

Data carving is extracting data from a raw bitstream (often based on identifying file headers/footers) in order to reconstruct files or parts of files.

• CarvFS
  http://ocfa.sourceforge.net/libcarvpath/
• Foremost - "console program to recover files based on their headers, footers, and internal data structures" from "image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive"
  http://foremost.sourceforge.net/
• Scalpel - "fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files"
  http://www.digitalforensicssolutions.com/Scalpel/